Forbid ".." in memory names

CHANGELOG.md

@@ -7,6 +7,7 @@ Status of the `main` branch. Changes prior to the next official version change w
   - Fix: Check for ignored path ignored `.git` folder only at the top level, not in every subdirectory (`Project._is_ignored_relative_path`) #1350
   - `GetSymbolsOverviewTool`: ignored paths were not respected in LSP variant (fix in `SolidLanguageServer`)
   - Fix: Duplicate comments in re-saved YAML configuration files #1285
+  - Security: Forbid `".."` in memory names to disallow accessing files outside dedicated memory directories
 
 * JetBrains:
   - `Move` and `SafeDelete` tools: transform empty string to None (counteracts client errors)

src/serena/project.py

@@ -79,7 +79,10 @@ class MemoriesManager:
 
     def get_memory_file_path(self, name: str) -> Path:
         # Strip .md extension if present
-        name = name.replace(".md", "")
+        name = name.replace(".md", "").replace(os.sep, "/")
+        parts = name.split("/")
+        if ".." in parts:
+            raise ValueError(f"Memory name cannot contain '..' segments for security reasons. Got: {name}")
 
         if self._is_global(name):
             if name == self.GLOBAL_TOPIC:
@@ -98,7 +101,7 @@ class MemoriesManager:
 
         # Project-local memory
         assert self._project_memory_dir is not None, "Project dir was not passed at initialization"
-        parts = name.split("/")
+
         filename = f"{parts[-1]}.md"
 
         if len(parts) > 1: